bugfix in password reset