corrected change password on login, removed unnecessary call to get user routes (now included as part of user information retrieval), removed /security/user/{userId}/routes