Update user.rb

added change password action