confirming forgotten passwords work