forgot password endpoint should be for anonymous users only. Fixes #291

flask_security/views.py

@@ -238,6 +238,7 @@ def confirm_email(token):
                     get_url(_security.post_login_view))
 
 
+@anonymous_user_required
 def forgot_password():
     """View function that handles a forgotten password request."""
 

tests/test_context_processors.py

@@ -81,6 +81,8 @@ def test_context_processors(client, app):
     def mail():
         return {'foo': 'bar'}
 
+    client.get('/logout')
+
     with app.mail.record_messages() as outbox:
         client.post('/reset', data=dict(email='matt@lp.com'))