password change not being persisted