forgot password accepts JSON