def METHOD_NAME(user, password):
    # reset failed login count - they've just reset their password so should be fine
    user.password = password
    user.password_changed_at = datetime.utcnow()
    user.password_expired = False
    db.session.add(user)
    db.session.commit()