response to login
allow user to change password, but not the username
allow user to reset password with e-mail reminder