I wanted to add a captcha to the Forgot Password form, so I ended up doing this to the default ForgotPasswordController: Only relevant bits are shown there.