fix small bug in update password api