change password working (against dev api); WIP hide/unhide candidate