Update security.md

Without 'reset' as the last segment in the route to the password reset it won't work. People renaming their route should know they leave '/reset' in their route.