moved password back to user