Update security.md

Included 'password' and 'password_confirmation' in the credentials for password resets.