ensure password is actually changed