fixed bug in forgot password API