updated changepassword to make it robust on client-authentication failure