Add password to permited params in user policy

It was preventing the user to change the password
Merge pull request #505 from neighborly/jl-fix-change-password

Add password to permited params in user policy