bug: change_password