fixed password reset mechanism