req.user.update({
    password: req.body.new_password,
  }).then(res.noContent).catch(next);