fixed urls for password change