first step of password reset procedure