Reset password link sent over unsecured http protocol