crsf and ion_auth reset password

The error: "The action you have requested is not allowed." might be because you either
1) Did not use form_open() in your view or
2) Did not add a hidden field to the form with the CSRF token and hash.

form_open() automatically adds the hidden field for you.

Nothing jumps out at me as wrong in your config settings.

I developed a simple controller and view to test if sessions are working.
It's easy to install (and remove) from a project and should provide a definitive answer to the question, "Are sessions working?"
The files are on github HERE

Hope it is helpful.