added password_reset to permissions, all specs pass