update - following password route