auth: user change password inside scheme interface