change the change password authorization to route to the USER controller (instead of the Account controller)