Week4 pull request 2

please take a look to see if you find any issues.
Make sure you always think about how much information you are giving out in your error messages.  Hackers use error messages to figure out things about your db.  Lots of sites display a success messages along the lines of "If that user is present in our system, you will receive instructions to reset your password soon."