move forgot password middleware so it doesn't break with connect-slashes