reorder so we check the token first
call to the server for forgotPassword