added reset-password routes to excluded routes from access_token