added verification test for bad forgot password flow

updated error responses to more closely match api.md