password change works, but takes empty passwords