correctly sets new passwords