pass the new password when updatepw was called