corrected the user update to only update the password when we want