whitespace
change password: check against User.nobody() (fixes #272)