added password change behavior.  completely rewrote to use slightly different flow