fixed ajax url on password reset