typo in password change logic