For #42: controller logic for resetting passwords