forgotten password request now works on API