updates both user and user_password table