allow reset if user has never logged in