fix bug for get old password from session