update user, change password