sharepopup: use stylesheet/javascript_tag
forgotpass: remove secretkey stuff because of new session handling; use stylesheet/javascript_tag