user can edit password now