updated pw reset to use user object, send confirmation email for pw change