fix bug: new password can not be none