password reminder email link should be a real link