Reverts to changeset 435, and just add {% csrf_token %} to template forgot_pw.html, since CSRF protection seems to be only here (surely because of django.contrib.auth.views).
#gravity { width: 100%; margin: 5px 0; border-spacing: 5px; }
#gravity td { text-align: center; vertical-align: middle; padding: 5px 0; background-color: #d0d0d0; }
#gravity a { }
#gravity a:hover { color: #505050; background: none; }