bug fix
check for user before checking password
change image url