fix reset password breakage by avoiding encoding ampersand in url (closes #123)