updated password reset process
made session overridable