add change_password route