allow unverified users to change password