Fix bug where a password could get changed without providing the old password

The password plugin uses loose comparison, leading to a type juggling vulnerability that
allows password changes without knowing the old password in specific cases.

Reported by flydragon777