update

XSS on forgot password, also added missing validation (username & password)