How should virtual users update their password?