user can change pw and change userlevel