fix forgot password checks+discussion

I got both of these working, and I got about 10 or 12 more assertions going on the account controller test (combo of old and new).