add resetPassword and changePassword to principal APIs