Fix a bug

The password and password_confirmation are not added into user_params,
so they are not permitted as parameters. This will fix the password
not changed problem.