password can be changed only for logged in user