move reset password function to User.js