forgot password should POST.