fix #208 : session-free /resetPassword and /register