added change password functionality

also added a session attribute with the id, so you dont have to use the
name everywhere