We can't do this using the ValidatesBeforeSave trait because the password has been hashed by then. Instead, we must validate the original password as it comes in.