refactored reset password controller specs and replaced _urls with _paths