If you only set a new password, none of the criteria are met for saving (the hash doesn't include password as its (correctly) a private property).