Fixed a bug in renderPage that broke the "reset password" feature: make sure req.extras actually exists before merging properties with it.