issue #19199: fixed gaping security hole in reset password