final fixes for /user/forgotpass