extend headers instead of overriding them
use standard api method for update password, now that it accepts custom headers