If we don't have permission to change another users' password, we should auth on demand here
If we don't have permission to change another users' password, we should auth on demand here