dont allow users to go to resetpassword.update without required query params
copy change for resetpassword.update