abstract out user update

putting user update in an auth method so we can reuse it.
admin can change password

Did some refactoring so ProfileController and UserController share
some code.  Although everything works, definitely need to refactor
this.  Way to complicated.
Merge pull request #59 from metridoc/admin-can-change-pw

Admin can change pw