change pw without direct db access