password recovery does not use locale for redirects if none is present