Drop the `user' password reset rule