added password change button to user/account
authorization is up for routes/controller actions that need it, let me know if it breaks or needs additional checks