bug fix in session#reset_password