add EditPassword permission for change password controller