document password reset routes, batch request handling