fixed a bug
no security check of new password