def update
      if params[:issue_reset_token] || params[:issue_verification_token]
        # For issuing a reset token, one does not need an auth token. so do
        # not authorize the request. For consistency, we require the id to
        # be "current".
        raise ApplicationController::UNAUTHORIZED_ERROR unless params[:id] == "current"
        get_user_for_token()
        if params[:issue_reset_token]
          update_token(:reset_token)
        else
          update_token(:verification_token)
        end
      else
        get_user()
        allow_password_change? if params[:password]
        update_user(user_params)
      end
    end
def update
      if params[:issue_reset_token] || params[:issue_verification_token]
        # For issuing a reset token, one does not need an auth token. so do
        # not authorize the request. For consistency, we require the id to
        # be "current".
        raise ApplicationController::UNAUTHORIZED_ERROR unless params[:id] == "current"
        get_user_for_token()
        if params[:issue_reset_token]
          update_token(:reset_token)
        else
          update_token(:verification_token)
        end
      else
        get_user()
        allow_password_change? if params[:password]
        update_user(user_params)
      end
    end
Patches the user object. There are four notable operations:

 - issue reset token
 - issue verification token
 - change password
 - others

 Issuing either reset token or verification token requires NO
 authentication. However, for that reason, the request does not get any
 meaningful response. Instead, an email is sent out for either request.

 For changing password, there are two ways. One is to use old password
 and the other is to use reset token.

 Otherwise, it's a normal update operation.