fix: dynamically pass password reset urls