sql now ensures that password update fields are not blank