implement add/remove password on account page, sans password strength verification