user password can now be updated