#1220062 fix mild security issue with login-reset links