fix building an URL for forgotten password