add password matches function and fix change password route