fix previous commit and use :put as desired.  also add a test that non-superuser can't modify password of another user via PUT /api/user/:id/password