fine-tune reset password process. still need to check expiration date of reset code