password resets controller spec: show action