move /api/users/profile => /api/profile
update profile
update password
assert that new password works
disallow blank password when password resetting