fixed user callbacks for password creation and updating