user.controller - chnage password fix