Is login the proper route/function for handling password changes? Why not a separate function and a separate route/URL for that?