Refactor user password update into its own controller