still need to figure out why Retrieve password for a non-existent user seems to send email