To reset password, we can require or not old password. By example, the rule does not require old password if authLevel equal 5