exposed the GET /forgot route on the user
controller