Do not require the CSRF protection on password reset (bug 1069546)