update keeps password fields