impossible to change password w/o being logged in