email templates
change password requires auth