modified User.update(when not contains password)