Resetting Password to blank possible

I found a minor inconvenience when resetting passwords via email and disabling browser form validation. There seems to be a missing validation check and just submitting the form without filling out password and password_confirm results in a lockout of the account requiring another password reset.

Another, more general question: If I were to change a underlying default controller action of Coherence how would you set something like that up? I am pretty new to elixir and i guess there is a way to replace an already defined defmodule action.

Many thanks