moved pw chg to user.js
Merge remote-tracking branch 'origin/master'