fix password check bug in PostResetPass action