@chiraag in principle a pw reset doesn't require login creds, so the registrare is being lazy & trying to save a buck, which is perhaps why they opted for CF.