don't forget to add the password resets routes to the app handler