tweak user-password spec