Don't ask for CSRF token when trying to view the password reset form.

1 files changed, 2 insertions, 2 deletions

diff --git a/modules/user/controllers/password.php b/modules/user/controllers/password.php
index 3b0eac66..2dde11b8 100644
--- a/modules/user/controllers/password.php
+++ b/modules/user/controllers/password.php
@@ -19,9 +19,9 @@
  */
 class Password_Controller extends Controller {
   public function reset() {
-    access::verify_csrf();
-
     if (request::method() == "post") {
+      // @todo separate the post from get parts of this function
+      access::verify_csrf();
       $this->_send_reset();
     } else {
       print $this->_reset_form();