The old password in plain text. The old password can be omitted if the pwd is changed for the first time. Alternatively old_password can be set to the pin as generated by user.password.recover.email().