Optional RESTful controller and routes
Fixed: able to update other fields without having the password confirmation