allow user to change their password on User#settings