change user/pass by token