update app.js for password reset