change password handler, html added