Set / verify password using REST API
Some quick remarks:


Keep your controllers lean and mean:


Move all of the processing (that you seem to have removed by using the comment // db stuff) to dedicated classes, 
bind it all together using MediatR, 
validate incoming data with FluentValidation.


There are plenty of examples that show you how to combine these two, e.g. this Stack Overflow question. Jimmy Bogard also has plenty of examples on his own blog, e.g. this post.

Microsoft also promotes this kind of structure:"Implement the Command and Command Handler patterns". (In this case in the context of CQRS, which is something that you also could look into.)
Don't needlessly abbreviate (why "pass" instead of "password"?).
Don't use exceptions to control your logic. An invalid password should IMHO not throw an exception, it's an expected result. Even worse it that you seem to be "eating" your exceptions and don't even log them.
WRT your app's logic, you might want to look at the logic in similar applications, e.g. "Simple API for Authentication, Registration and User Management". Also think about things like "how many times can a user try to log in and fail before his account gets locked?" in order to avoid hackers who'll try to access the system by going through large lists of often-used passwords.