I forgot my password will upgrade the password type if it should
Don't use $_REQUEST["cap"] for a reset-password capability.

$_REQUEST["cap"] is special; it is automatically parsed and reset
by Contact, and should only be used by paper capabilities.

Chris Kanich report.