Add password to permited params in user policy

It was preventing the user to change the password.

It fixes #504.