add PUT support for /user/<int:userId>/password