allow user to change their password