Removed CSRF protection from reset_password()