Use rack-flash3 instead of my own hacked version
Use a password reset link, rather than sending a new password