if no email passed to reset password return badRequest