adding update password + update_account api with securized token validation