api/change_password works