fix bug - if identity is other than email or username, user can not change password.