in-memory password reset -- but lacks session for last bit