moved password redirect to inside the success block