Moved the forgotten password logic to its own controller.