GUI: fixed access to non-authz password reset