User update_password

Calling update_password without a reset key or old password returns a validation error instead of a 500.