Cleanup user endpoints

Change password is now a simple "user update"