forgot password: user takes his own password