Password request page shouldn't require authentication