bug fix. password update on user