move password_change logic to base