wrestled with password updating and validation