specs for password reset