issue #20474: safer change password