`/auth/forgot-password` now checks to see if the username is a valid one.