always replace userPassword