public function password($request, $match)
    {
        $msg = array(
            'message' => 'succcess'
        );
        // TODO: maso, 2017: recover by mail
        if (array_key_exists('email', $request->REQUEST)) {
            $sql = new Pluf_SQL('email=%s', array(
                $request->REQUEST['email']
            ));
            $user = $request->user->getOne($sql->gen());
            if ($user) {
                $this->sendPasswordToken($request, $user);
            }
            return $msg;
        }
        // TODO: maso, 2017: recover by login
        if (array_key_exists('login', $request->REQUEST)) {
            $sql = new Pluf_SQL('login=%s', array(
                $request->REQUEST['login']
            ));
            $user = $request->user->getOne($sql->gen());
            if ($user) {
                $this->sendPasswordToken($request, $user);
            }
            return $msg;
        }
        // Reset password by token
        if (array_key_exists('token', $request->REQUEST)) {
            $token = new User_PasswordToken();
            $sql = new Pluf_SQL('token=%s', array(
                $request->REQUEST['token']
            ));
            $token = $token->getOne($sql->gen());
            if (! $token || $token->isExpired()) {
                throw new Pluf_Exception_DoesNotExist('Token not exist');
            }
            $user = $token->get_user();
            $user->setPassword($request->REQUEST['new']);
            $user->update();
            $token->delete();
            return $msg;
        }
        // Reset password by old password
        if (array_key_exists('old', $request->REQUEST) || array_key_exists('old_password', $request->REQUEST)) {
            $oldPass = array_key_exists('old', $request->REQUEST) ? 
            $request->REQUEST['old'] : $request->REQUEST['old_password'];
            if ($request->user->isAnonymous()) {
                throw new Pluf_Exception_Unauthorized();
            }
            // Retreive credential
            $cred = User_Credential::getCredential($request->user->id);
            if (! $cred->checkPassword($oldPass)) {
                throw new Pluf_Exception_MismatchParameter('Old pass is not currect');
            }
            $newPass = array_key_exists('new', $request->REQUEST) ? 
                $request->REQUEST['new'] : $request->REQUEST['password'];
            $cred->setPassword($newPass);
            $cred->update();
            return $msg;
        }

        throw new Pluf_Exception_MismatchParameter('Invalid request params');
    }