Add api for user update password: need current_password