exercise forgot-pw flow, untested