resetPassword now has its own controller