fixed bad pointer reference in password update