improve upgrade wizard, add password change steps
don't assume a cookie user exists