route fix on password form