models-user.js

User.newPassword = function(user, currentUser, done) {
  pass.hash(password, function(err, salt, hash) {
    currentUser.__password = {
      salt: salt,
      hash: hash
    }
    currentUser.updatedAt = new Date();

    User
      .save(currentUser, done);
  });
}

routers-users.js

router.post('/newPassword', function (req, res) {
  User.newPassword(req.currentUser, req.body.password, function (err) {
    res.send(200);
  };
});