I'm just testing the lost password feature on a site I currently have in development. So I visit the page (http://new.sworcs.ac.uk/Security/lostpassword), enter my email address, and within a few minutes I recieve an email with a reset password link in it.
So far so good..
The problem is, once I hit the reset password link in the email, I'm taken to a form which not only asks me for my new password, but also asks me for my old one as well.
This would be fine if I knew what my old password was, but seeing as I started this process by using the lost password form, this doesn't make any sense.
Am I missing something?
Thank you.