implementing api/change_password