Users can change their own passwords

fixes #113