fixed use of incorrect error response method
allowed client to set password on user