password reset will use the user has