add password changing feature (still buggy)