add protection to the "forgot_password"

when sms_code does not exist, give error message