update routes in a more restful style, and add api for updating user profile and password