refactor code and move routes to the top
keep old password on change request. fix #1