do not set password as it reset the users login session