updated with working change/recover password functions