password change starting to work

lib/routes/user.js

@@ -4,21 +4,78 @@ regexp:true, undef:true, strict:true, trailing:true, white:true */
 
 (function () {
   "use strict";
-  
+
   var salt, crypt, _fs = X.fs, _path = X.path, _ = X._;
-  
+
   require("../ext/administrative_route");
-  
+
   salt = _fs.readFileSync(_path.join(X.basePath, X.secureSaltFile), "utf8").trim();
-  
+
   crypt = function (password) {
     var md5 = X.crypto.createHash('md5');
     md5.update(salt + password);
     return md5.digest('hex');
   };
-  
+
   X.userRoute = X.AdministrativeRoute.create({
-    update: function (xtr, id) {   
+    /**
+      Sends requests to the appropriate function
+
+      @param {X.Reponse} xtr
+     */
+    handle: function (xtr) {
+      var clientModel = this.get("clientModel"), method = xtr.get("method"),
+          data = xtr.get("json");
+
+      if (method === "PUT") {
+        this.update.apply(this, arguments);
+
+      } else if (method === "DELETE") {
+        this.delete.apply(this, arguments);
+
+      } else if (method === "POST") {
+        if (data.lookup) {
+          delete data.lookup;
+          this.lookup(xtr, data);
+
+        } else if (data.changePassword) {
+          delete data.changePassword;
+          this.changePassword(xtr, data);
+
+        } else {
+          this.new.apply(this, arguments);
+        }
+
+      } else {
+        this.fetch.apply(this, arguments);
+      }
+    },
+
+    changePassword: function (xtr, data) {
+      var data = xtr.get("json"),
+        oldPassword = null,
+        K = this.get("model");
+
+      if (data.oldPassword) {
+        oldPassword = crypt(data.oldPassword);
+      }
+
+      K.findOne({id: data.id, password: oldPassword}, function (err, k) {
+        if (err || !k) {
+          return xtr.error({isError: true, reason: err ? err : "could not find user"});
+        }
+        k.password = crypt(data.newPassword);
+        k.save(function (err, res) {
+          if (err) {
+            return xtr.error({isError: true, reason: err});
+          } else {
+            xtr.write(res).close();
+          }
+        })
+      });
+    },
+
+    update: function (xtr, id) {
       var data = xtr.get("json"), password = null, K = this.get("model");
       if (data.password) password = crypt(data.password);
       K.findOne({_id: data._id}, function (err, k) {