Fix reset password code

There is a condition where reset codes will contain invalid uri characters. Since the reset email uses the code and if query strings are turned off, this will cause invalid codes.

Example hash code: abc/def

When the reset code gets submitted it will read "abc" as a segment and pass it in as a code parameter instead of the full code. The forward slash causes the issue. This update replaces all invalid characters with a dash.

+ fix password reset code to avoid non safe uri characters when enable
query strings is set to false.