fixed edit pw, added validation, added controller filter, and 2 callbacks