bare-bones pw reset implemented