logged in user can update his password. refactoring needed in password controller