change password endpoint must be prefixed with api/