added password reset on User model and session_controller