basic fixes
match server convention for change-password token spellings