compile bug on password reset success page
add decent default password complexity validator