update changePassword url to password