a little more careful error reporting in the password reset