moved password reset to user pages controller