password reset should use username