move edit password to app.js