let users manage their own passwords