password reset first pass

requiring entering the email address again that you used  for both
activate and reset may be controversial but I'll claim "security"