Update security.md

Included 'password' and 'password_confirmation' in the credentials for password resets.
Merge pull request #464 from oppenheimer/patch-1

Update security.md