change password functional

hashed and injection protected. still needs secondary new password
verification field.