refine forgot password mechanism & get baseurl from the request instead of settings