code: function (req, res) {
      // check for a user id
      if (!req[this.paramName]._id) {
        return res.badRequest();
      }
  
      req[this.paramName].password = req.body.password;
      delete req.body.password;
  
      req[this.paramName].save(function (err) {
        if (err) {
          return res.handleError(err);
        }
        return res.noContent();
      });
    }
docs: README
  Replaces an existing user password in the DB using the request body
  property named 'password'. Should be an admin only route.
  @param {IncomingMessage} req - The request message object
  @param {ServerResponse} res - The outgoing response object
  @returns {ServerResponse} The updated document or NOT FOUND if no document has been found