620 change user password

closes #620
could we simply use the `username` here? the `uid` can always be generated. do we even need the username or `uid` as input?