updates change password routing spec to patch