code: func hapiResetPasswordSubmit(w http.ResponseWriter, r *http.Request) {
  	var req struct {
  		Password string
  		Secret   string
  	}
  	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
  		writeErrorInternal(w, err)
  		return
  	}
  	if len(req.Password) < 8 {
  		writeError(w, errors.New("Your password must be at least 8 characters"))
  		return
  	}
  
  	var uid uint64
  	q := `SELECT userid FROM passwordresets
  	      WHERE secret=$1 AND
  	      createdat >= CURRENT_TIMESTAMP - interval '30 minutes'`
  	err := db.Get(&uid, q, req.Secret)
  	if err == sql.ErrNoRows {
  		writeError(w, errors.New("Sorry, that information doesn't match our records."))
  		return
  	}
  	if err != nil {
  		writeError(w, err)
  		return
  	}
  
  	hpw, err := bcrypt.GenerateFromPassword([]byte(req.Password), 10)
  	if err != nil {
  		writeError(w, err)
  		return
  	}
  	tx, err := db.Begin()
  	if err != nil {
  		writeError(w, err)
  		return
  	}
  
  	q = `UPDATE users SET password=$1 WHERE id=$2`
  	if _, err = tx.Exec(q, hpw, uid); err != nil {
  		writeError(w, err)
  		return
  	}
  	q = `DELETE FROM passwordresets WHERE secret=$1`
  	if _, err = tx.Exec(q, req.Secret); err != nil {
  		writeError(w, err)
  		return
  	}
  	if err = tx.Commit(); err != nil {
  		writeError(w, err)
  		return
  	}
  	w.WriteHeader(http.StatusOK)
  }
docs: // hapiResetPasswordSubmit is arrived at through the email generated by
  // hapiForgotPasswordSubmit. This endpoint resets the user password with
  // another bcrypt hash after validating on the server that their new password is
  // sufficient.