move forgot password function to User.js