changed password tool so that user specifies their password at account request