change password (restore)