amend: only visitors can reset their password, not logged users