feat(users): let users change password