Allows new_password has whitelisted user param