users can now update password