Unable to upload a new profile picture when the browser has the password stored

Description:

Strange bug earlier here in the office. Some of our users allow their browsers to save their credentials for several websites (big no-no in our company, we're still educating them about that), and one of these sites happens to be our instance of Rocket.Chat.

When one of our Livechat agents was trying to change their profile picture, a failure notification appeared, saying that the password was the same as the current one, which was strange, to say at least, since they were trying to upload a image, not update a password.

Upon closer inspection, I've noticed that the password field was filled, when clearing the field, and by magic, they were able to upload a new avatar. I've asked them if they filled it out, and they said no. Then I asked if they had their password saved in their browser, and they said yes.

But the most troubling of all, the field used for password confirmation was blank, so the application shouldn't even trying to execute a password update operation. So the fact that browser fills the password shouldn't even be an issue.

Steps to reproduce:

1. Login to Rocket.Chat
2. Allow the browser to save your credentials
3. Go my account
4. Try to upload a new profile picture

Expected behavior:

For the profile picture to be update without issue

Actual behavior:

An error about the password an the avatar isn't update

Server Setup Information:

• Version of Rocket.Chat Server: 3.16.1
• Operating System: linux
• Deployment Method: Docker
• Number of Running Instances: 1
• DB Replicaset Oplog: Enabled
• NodeJS Version: 12.22.1
• MongoDB Version: 4.0.25

Client Setup Information

• Desktop App or Browser Version: Firefox and Chrome, latest versions
• Operating System: Ubuntu 20.04

Additional context

Relevant logs:

No source file or test is named in the issue. Reproduce the profile-picture upload in Firefox or Chrome with saved credentials, then trace the profile form and add coverage; done means the avatar uploads without a password error when the confirmation field is blank.