[chore]user can update password