ref #38, password reset