allow changing userPassword only through extended operations?