add password_reset_sent_at to permitted params