response in changePassword was always set