sendResetEmail is not public - ugh
cors, evil cors