change session creation policy
add update password in the service class
add update password method in persistence class
add update password endpoint