code: function handleReset(req, res, next) {
  		var p = new Promise(function (resolve, reject) {
  			const currentToken = req.params.token || 'missing';
  			const email = req.params.email || 'missing@email.com';
  			const password = req.params.password;
  			if (!password) {
  				return reject(new restifyErrors.BadRequestError("New password is missing"));
  			}
  			const qry = {
  				local_auth_type: 'password',
  				active: true,
  				email: email,
  				verify_token: currentToken
  			};
  			AclUser.findOne(qry, function (err, usr) {
  				if (err) {
  					debug(`Error finding user for password reset`, err);
  					return reject(new restifyErrors.InternalError(err));
  				}
  				if (!usr) {
  					debug(`Password reset email address and reset token did not match`, email);
  					return reject(new restifyErrors.InvalidCredentialsError("Email address and reset token did not match"));
  				}
  				usr.verify_token = "password-reset:" + usr.generateVerifyHash();
  				usr.modifiedBy = 'password-reset';
  
  				debug(`Updating ${email} with a password reset`);
  				usr.setPassword(password, function () {
  					usr.save(function (err, user) {
  						if (err) {
  							debug(`Error updating user during password reset`, err);
  							return reject(new restifyErrors.InternalError(err));
  						}
  						const data = {
  							'success': true,
  							'message': "Password updated"
  						};
  						resolve(data);
  					});
  				});
  			});
  		}).then(function (data) {
  			res.json(data);
  			next();
  		}).catch(function (err) {
  			debug(`Password reset request failed`, err);
  			next(err);
  		});
  	}
docs: handleForgot *********************************************************