add user password modification, and have already test in controller level