readme: add forgot password flow