user password controller bugfix