password reset (pre-solution refactor, but with guidance to controller setup from first part of solution)