added 'passwordToken' to create user, fixed small bug with changePassword attribute