run password_change before authorize
incorporate some of joseph's changes
remove debug printouts