updated password routes