changes to sessions

Attempts to fix a flaw with the "forgot password" process