removed password requirement to change user attributes