auth improvements. support reset password.