Also, this needs to be scrubbed; email addresses will contain an @ symbol almost invariably, and that needs to be converted to it's URL-safe equivalent (%40).  Values passed via GET request are separated by ampersands instead of semicolons.  A URL that looked like this worked for me:
```http://webdev.microbio.me/americangut/forgot_password.psp?email=adam.robbinspianka%40colorado.edu&kit_id=AG_beta_9&passcode=5tYy8PLTAjmI1BPkIhL7```