remove sha-256 from change password request

fixes #432