fix bug in change password. add tests