rearranged password updating code (now authenticates user after password has been reset), added setref code to all necessary pages