password changes now work