add update password to controller