change app_delete_password to pass in POST param