fix old password check in update_password api - closes #114

lib/wsapi/update_password.js

@@ -23,6 +23,11 @@ exports.process = function(req, res) {
         return res.json({ success: false });
       }
 
+      if (!success) {
+        logger.info("password update fails, incorrect old password");
+        return res.json({ success: false });
+      }
+
       logger.info("updating password for email " + req.session.authenticatedUser);
       wsapi.bcryptPassword(req.body.newpass, function(err, hash) {
         if (err) {