finishing up login, change pwd