Update user.rb

added change_password