move more work into the html preprocessor, implement update password