Forgot password does not use signed urls when use_signed_email_verification_url is enabled

[LiamKarlMitchell]

Not sure if it is an oversight as an email is sent to the user with a link, but it is not signed.