Add updated_password_at for users
Got password validation to work and so that it does not sign out the user