I disagree with the url design - core and ajax are of no interest here

POST /lostpassword/mail
POST /lostpassword/reset

or some thing like that @Raydiation