user resets password spec