user_controller change password and update attributes