requires both username and email to reset password