We should have a captcha to protect this url
CMS-4550 FO account management - remove the captcha on the "new token" form