mcklayin

Show your .htaccess file content

Show you routes.php. You can try to use full url in ajax:url instead of url: "product/addlist&...

It means your browser doesn't have a correct tokens. See your middlewares

Try to use $request->email, $request->password

Make dd() of $oldpassword and $user->password, to see what data's printed