update docs so that lpad reset doesn't always require a password