users can now reset their passwords