Update the API signature for update_password; there's not really any point in forcing an API user to repeat their new password, so I hid that complexity.