Fix 'forgot password' flow