fixed potential security flaw in password reset