ensure non-empty password on change password from reset key
remove password param from add password reset secret API