403 on user password change when in production