Shouldn't even have the ability to reset the user's own account