Changed PUT /passwords to POST /passwords to prevent preflight CORS-requests