security fix for forgotten password page