reject password reset for external (ie facebook) users