fixed update user.points for manual point mutations
remove check on token expiration for change password