Move new password form from controller to application/forms