add test coverage for password policies during reset