users can now change their password, and more flash messages
changed visible_to_owner to hidden_from_owner