fixed user update bug, but user has to login after password update