add change_password method to user model