reset password using email address instead of user name