fixed user update so if pwd not provided it is not required