add change password for users and clean up user routes