Note: For security it's recommended to implement a token-based password reset (one-time link) instead of emailing plain-text passwords.