update password form no longer depends on session hash, uses hidden field now