When the user is registred in the session, the method "eraseCredentials" is cal$
( Thelia\Core\Security\SecurityContext::setCustomerUser ).
The form checks if the customer user of the session has the password given,
or, in the session, the password is null, so it doesn't work.
modifié: core/lib/Thelia/Form/CustomerPasswordUpdateForm.php