Moved route actions into controllers; user admin form only requires password for existing user if password is entered