password reset files and db