tweak to make sure the password update only happens on successful login