reset password API works over POST

accidentally undid when I changed it to POST