Fixed server side validation for password reset