request user password ONLY before changing password
fixed tests