user can now request a new password