tiny password reset bug