password change form; closes #2