diff --git a/acl/forgot_send.cgi b/acl/forgot_send.cgi
index 32472e7ae..8b3d0015b 100755
--- a/acl/forgot_send.cgi
+++ b/acl/forgot_send.cgi
@@ -34,6 +34,7 @@ $link{'id'} || &error($text{'forgot_erandom'});
 &write_file("$main::forgot_password_link_dir/$link{'id'}", \%link);
 my $baseurl = &get_webmin_email_url();
 my $url = $baseurl.'/forgot.cgi?id='.&urlize($link{'id'});
+&load_theme_library();
 $url = &theme_forgot_url($baseurl, $link{'id'}, $link{'user'})
 	if (defined(&theme_forgot_url));
 
diff --git a/forgot_form.cgi b/forgot_form.cgi
index f4bf9c1b4..2e4c4892a 100755
--- a/forgot_form.cgi
+++ b/forgot_form.cgi
@@ -20,7 +20,7 @@ print $text{'forgot_desc'},"<p>\n";
 print &ui_form_start("forgot_send.cgi", "post");
 print "<b>$text{'forgot_user'}</b>\n",
       &ui_textbox("forgot", $in{'failed'}, 40),"<br>\n";
-print &ui_form_end([ [ undef, $text{'forgot_ok'} ] ]);
+print &ui_form_end([ [ undef, $text{'forgot_go'} ] ]);
 print "</center>\n";
 
 &ui_print_footer();
diff --git a/forgot_send.cgi b/forgot_send.cgi
index b470b1a9e..658ef7b51 100755
--- a/forgot_send.cgi
+++ b/forgot_send.cgi
@@ -45,7 +45,7 @@ foreach my $key ($ENV{'REMOTE_ADDR'},
 		 $uuser ? ( $uuser->{'user'} ) : ( ),
 		 $email ? ( $email ) : ( )) {
 	# Don't block if disabled
-	next if (!$failures || !$ptime);
+	next if (!$pfailures || !$ptime);
 
 	if (!$ratelimit{$key."_last"} ||
 	    $ratelimit{$key."_last"} < $now-$ptime*60) {
diff --git a/lang/de b/lang/de
index 29b080a9c..681924aa4 100644
--- a/lang/de
+++ b/lang/de
@@ -149,7 +149,7 @@ session_forgot=Passwort vergessen?
 forgot_title=Zurücksetzen eines vergessenen Passworts
 forgot_user=Webmin-Benutzer:innenname:
 forgot_desc=Wenn Ihr Webmin-Login mit einer Wiederherstellungs-E-Mail-Adresse verknüpft ist, können Sie auf dieser Seite einen Link anfordern, um das Passwort zurückzusetzen.
-forgot_ok=Link zum Zurücksetzen des Passworts senden
+forgot_go=Link zum Zurücksetzen des Passworts senden
 forgot_ecannot=Die Wiederherstellung vergessener Passwörter ist nicht aktiviert!
 forgot_euser=Der Benutzer:innenname existiert entweder nicht oder es ist keine Wiederherstellungs-E-Mail-Adresse konfiguriert.
 forgot_msg=Sie erhalten diese E-Mail aufgrund einer Anfrage zur Passwortwiederherstellung im Webmin-System auf $4 von $3 für den Login $1.\n\nWenn Sie das Passwort zurücksetzen möchten, folgen Sie diesem Link:\n$2
diff --git a/lang/en b/lang/en
index 4d0b65b7a..7be99771e 100644
--- a/lang/en
+++ b/lang/en
@@ -149,7 +149,7 @@ session_forgot=Forgot Password?
 forgot_title=Reset Forgotten Password
 forgot_user=Webmin username:
 forgot_desc=If your Webmin login has a recovery email address associated with it, you can use this page to send a link that can be used to reset the password.
-forgot_ok=Send Password Reset Link
+forgot_go=Send Password Reset Link
 forgot_ecannot=Forgotten password recovery is not enabled!
 forgot_euser=The username either does not exist or does not have a recovery email configured.
 forgot_msg=You are receiving this email due to a request for password recovery from the Webmin system at $4 from $3, for the login $1.\n\nIf you would like to proceed with resetting the password, follow this link :\n$2
diff --git a/usermin/edit_session.cgi b/usermin/edit_session.cgi
index 321bb9934..11bcb79f5 100755
--- a/usermin/edit_session.cgi
+++ b/usermin/edit_session.cgi
@@ -26,16 +26,16 @@ print &ui_table_row($text{'session_ptimeout'},
 print &ui_table_row($text{'session_pblock'},
     &ui_checkbox("blockhost_on", 1,
         text('session_blockhost',
-          ui_textbox("blockhost_failures", $miniserv{'blockhost_failures'}, 4),
-          ui_textbox("blockhost_time", $miniserv{'blockhost_time'}, 4)),
+          ui_textbox("blockhost_failures", $miniserv{'blockhost_failures'}, 2),
+          ui_textbox("blockhost_time", $miniserv{'blockhost_time'}, 2)),
         $miniserv{'blockhost_failures'} ? 1 : 0));
 
 # Block users
 print &ui_table_row("",
     &ui_checkbox("blockuser_on", 1,
         text('session_blockuser',
-          ui_textbox("blockuser_failures", $miniserv{'blockuser_failures'}, 4),
-          ui_textbox("blockuser_time", $miniserv{'blockuser_time'}, 4)),
+          ui_textbox("blockuser_failures", $miniserv{'blockuser_failures'}, 2),
+          ui_textbox("blockuser_time", $miniserv{'blockuser_time'}, 2)),
         $miniserv{'blockuser_failures'} ? 1 : 0));
 
 # Log to syslog
@@ -96,7 +96,7 @@ print &ui_table_row($text{'session_authmode'},
 		  [ [ 0, $text{'session_authmode0'}."<br>" ],
 		    [ 1, &text('session_authmode1',
 			      &ui_textbox("passwd_file",
-					  $miniserv{'passwd_file'}, 20),
+					  $miniserv{'passwd_file'}, 12),
 			      &ui_textbox("passwd_uindex",
 					  $miniserv{'passwd_uindex'}, 2),
 			      &ui_textbox("passwd_pindex",
@@ -147,7 +147,7 @@ print &ui_table_row($text{'session_domain'},
 		     $miniserv{'user_mapping'})." ".
 	&ui_filebox("user_mapping", $miniserv{'user_mapping'}, 30).
 	"<br>\n".
-	"<b>".$text{'session_userfmt'}."</b> ".
+	"$text{'session_userfmt'} ".
 	&ui_radio("user_mapping_reverse",
 		  int($miniserv{'user_mapping_reverse'}),
 		  [ [ 0, $text{'session_userfmt0'} ],
diff --git a/webmin/edit_session.cgi b/webmin/edit_session.cgi
index 47c69bc51..3075a667a 100755
--- a/webmin/edit_session.cgi
+++ b/webmin/edit_session.cgi
@@ -23,16 +23,16 @@ print &ui_table_row(&hlink($text{'session_ptimeout'}, 'ptimeout'),
 print &ui_table_row($text{'session_pblock'},
     &ui_checkbox("blockhost_on", 1, 
 	text('session_blockhost',
-	  ui_textbox("blockhost_failures", $miniserv{'blockhost_failures'}, 4),
-	  ui_textbox("blockhost_time", $miniserv{'blockhost_time'}, 4)),
+	  ui_textbox("blockhost_failures", $miniserv{'blockhost_failures'}, 2),
+	  ui_textbox("blockhost_time", $miniserv{'blockhost_time'}, 2)),
 	$miniserv{'blockhost_failures'} ? 1 : 0));
 
 # Block bad users
 print &ui_table_row("",
     &ui_checkbox("blockuser_on", 1, 
 	text('session_blockuser',
-	  ui_textbox("blockuser_failures", $miniserv{'blockuser_failures'}, 4),
-	  ui_textbox("blockuser_time", $miniserv{'blockuser_time'}, 4)),
+	  ui_textbox("blockuser_failures", $miniserv{'blockuser_failures'}, 2),
+	  ui_textbox("blockuser_time", $miniserv{'blockuser_time'}, 2)),
 	$miniserv{'blockuser_failures'} ? 1 : 0));
 
 # Lock Webmin users who failed login too many times
@@ -62,7 +62,7 @@ if (!$miniserv{'session'}) {
 print &ui_table_row($text{'session_sopts'},
 	&ui_checkbox("logouttime_on", 1, 
 		&text('session_logouttime',
-			&ui_textbox("logouttime", $miniserv{'logouttime'}, 10)),
+			&ui_textbox("logouttime", $miniserv{'logouttime'}, 3)),
 		 $miniserv{'logouttime'} ? 1 : 0).
 	"<br>\n".
 	&ui_checkbox("remember", 1, $text{'session_remember'},
@@ -106,7 +106,7 @@ print &ui_table_row($text{'session_popts'},
 		     $miniserv{'pam_end'}).
 	"<br>\n".
 	&text('session_pfile',
-	      &ui_textbox("passwd_file", $miniserv{'passwd_file'}, 20),
+	      &ui_textbox("passwd_file", $miniserv{'passwd_file'}, 12),
 	      &ui_textbox("passwd_uindex", $miniserv{'passwd_uindex'}, 2),
 	      &ui_textbox("passwd_pindex", $miniserv{'passwd_pindex'}, 2)));
 
@@ -160,14 +160,16 @@ $gconfig{'passreset_time'} //= 60;
 print &ui_table_row($text{'session_passresetdesc'},
     &ui_checkbox("blockpass_on", 1, 
 	text('session_passreset',
-	  &ui_textbox("passreset_failures", $gconfig{'passreset_failures'}, 4),
-	  &ui_textbox("passreset_time", $gconfig{'passreset_time'}, 4)),
+	  &ui_textbox("passreset_failures", $gconfig{'passreset_failures'}, 2),
+	  &ui_textbox("passreset_time", $gconfig{'passreset_time'}, 2)),
 	$gconfig{'passreset_failures'} ? 1 : 0));
 
 # Password reset link expiry
 $gconfig{'passreset_timeout'} ||= 15;
-print &ui_table_row(&text('session_passtimeout',
-	&ui_textbox("passreset_timeout", $gconfig{'passreset_timeout'}, 4)));
+print &ui_table_row($text{'session_passtimeoutdesc'},
+	&text('session_passtimeout',
+		&ui_textbox("passreset_timeout",
+			$gconfig{'passreset_timeout'}, 2)));
 
 print ui_table_end();
 print ui_form_end([ [ "save", $text{'save'} ] ]);
diff --git a/webmin/lang/en b/webmin/lang/en
index 971504efa..2b3ac36ea 100644
--- a/webmin/lang/en
+++ b/webmin/lang/en
@@ -681,6 +681,7 @@ session_eforgot=Forgotten password recovery cannot be enabled unless the <b>Virt
 session_passresetdesc=Password recovery throttling
 session_passreset=Block clients with more than $1 requests for $2 minutes
 session_epassreset_failures=Missing or invalid blocking requests
+session_passtimeoutdesc=Password reset link expiry
 session_passtimeout=Password reset link expires in $1 minutes
 session_epassreset_timeout=Missing or invalid password reset timeout