rough version of reset passwords controller