update change_password to consistently use stored password
logic to trigger password change from absense of file