user can now change his password