now, user can change password