add user settings page for updating password