restrict access to change password page