fixed routes having extra resources for users, was breaking password reset