// user is your result from userschema using mongoose id user.changePassword(req.body.oldpassword, req.body.newpassword, function(err) ...
// user is your result from userschema using mongoose id user.setPassword(req.body.password, function(err, user){ ..