allow password changes