My user is already loggedin with a valid token, but in some important operations (like confirm or cancel of a paid subscription), I want it to send the password along the other data, so the server validate it. By now, my application has the users in a database, and it was easy to develop this way.
How can I check that user sent password correctly? Will I need to try to login with the username and password in my backend?