Avoid using deprecated opIndex based access of session.
Fix password reset code handling bug.