more functional password reset flow