changed a notice and removed the changing the reset password token bit
added specs for update password action