[update] don't require password on save