if the password changed, user need re-login