forgot and reset password, use csrf
Merge branch 'jstrick'