Password should not be in clear in the "I have forgotten my password" email.

If we're going to be certifying and working on being secure, sending the password when forgotten in clear in an email is certainly not the right way to do this.

I would suggest a "reset password" link that brings you back to myID.is and asks you to reset your password.