changing password trivially works