fixed reset password permission