update password routes to add code and basic reset form (bugs)