the login user can change password