add update password route