authorize user update and validate new password