add controller to allow user change password