send username with "forgot password" email. use model to set password instead of mongoskin