refine change password logic