implement more /user/ function. Also, support Password change.