backend implementation of password reset