user config & change password permission