The current password is required even though you are signed in — a stolen session should not be enough to lock you out of your own account. Every session is signed out afterwards.