email forgot password and signup, but neither forgot password and signup had the correct link to interact with security token