--- a/pkg/controllers/routes.go	Fri Oct 18 13:48:20 2019 +0200
+++ b/pkg/controllers/routes.go	Fri Oct 18 15:17:31 2019 +0200
@@ -39,6 +39,16 @@
 		any           = auth.EnsureRole("sys_admin", "waterway_admin", "waterway_user")
 	)
 
+	// Password resets.
+	api.Handle("/users/passwordreset", &mw.JSONHandler{
+		Input:  func(*http.Request) interface{} { return new(models.PWResetUser) },
+		Handle: passwordResetRequest,
+		NoConn: true,
+	}).Methods(http.MethodPost)
+
+	api.HandleFunc("/users/passwordreset/{hash}", passwordReset).
+		Methods(http.MethodGet)
+
 	// User management.
 	api.Handle("/users", any(&mw.JSONHandler{
 		Handle: listUsers,
@@ -88,16 +98,6 @@
 		Handle: setSystemSettings,
 	})).Methods(http.MethodPut)
 
-	// Password resets.
-	api.Handle("/users/passwordreset", &mw.JSONHandler{
-		Input:  func(*http.Request) interface{} { return new(models.PWResetUser) },
-		Handle: passwordResetRequest,
-		NoConn: true,
-	}).Methods(http.MethodPost)
-
-	api.HandleFunc("/users/passwordreset/{hash}", passwordReset).
-		Methods(http.MethodGet)
-
 	// Print templates
 	api.Handle("/templates", any(&mw.JSONHandler{
 		Handle: listPrintTemplates,