Fixed routes with access token.

- implement initial change password.