Add change password API route