new password field isn't part of the user schema