clean up urls ; implement password change