move password update to profiel controller