def allow_password_change?
        if params[:old_password]
          unless @user.authenticate(params[:old_password])
            raise ApplicationController::UNAUTHORIZED_ERROR 
          end
        else
          unless @token == @user.reset_token
            raise ApplicationController::UNAUTHORIZED_ERROR
          end
        end
        return true
      end
def allow_password_change?
        if params[:old_password]
          unless @user.authenticate(params[:old_password])
            raise ApplicationController::UNAUTHORIZED_ERROR 
          end
        else
          unless @token == @user.reset_token
            raise ApplicationController::UNAUTHORIZED_ERROR
          end
        end
        return true
      end
Check if password change should be allowed. Two ways to do this: one
 is to use old password or to use a valid reset token.

 A ApplicationController::UNAUTHORIZED_ERROR is thrown for invalid old password or
 invalid reset token