No password length restriction in reset password endpoint