updated w/ change password and handling of unkown user