update to match forgot-password flows, emails are no longer hex-encoded