user cannot reset password when password param is blank