password change implemented. Session stores user id