title: Implement change password with Loopback
body: <p>I am trying to implement the change password feature with Loopback's built-in method, It works fine, but it doesn't update the password with <code>hash</code> instead it just saves a plain text in the db. I am using <code>loopback-component-passport</code> npm package in this project. I have searched many sites but I am unable to find the proper way to implement this feature. Does anyone have idea how to do this?</p>
  
  <pre><code>//Change user's pasword
  app.post('/change-password', function(req, res, next) {
    var User = app.models.user;
    if (!req.accessToken) return res.sendStatus(401);
    //verify passwords match
    if (!req.body.password || !req.body.confirmation ||
      req.body.password !== req.body.confirmation) {
      return res.sendStatus(400, new Error('Passwords do not match'));
    }
  
    User.findById(req.accessToken.userId, function(err, user) {
      if (err) return res.sendStatus(404);
      user.hasPassword(req.body.oldPassword, function(err, isMatch) {
        if (!isMatch) {
          return res.sendStatus(401);
        } else {
          user.updateAttribute('password', req.body.password, function(err, user) {
            if (err) return res.sendStatus(404);
            console.log('&gt; password change request processed successfully');
            res.status(200).json({msg: 'password change request processed successfully'});
          });
        }
      });
    });
  });
  </code></pre>