fix elsif statement and use strong params in password_resets_controller