fixed the update method on resetPassword to use $set operator

also moved the "new password" to be underneath the old password and old
password confirmation on the resetPassword page