module users: fix lostpass