prepped the password reset flow for patient, now implement the record update - unsure of need for a security question if there is a password reset auth token