The form to change password has only the new password and confirm password.
The old password should be required to check user is the authorized user