in callback user password changed to secret