move password manage function to mvc