move resetPassword to index.js