password reset should be one spec