fixed password reset flow