Fix bugs

I wrongly added 'dependent: :destroy' in Figure model, which caused a
dead loop when deleting a figure.

Move the change password into a separate page.

Also fix the figure attachment.