Access denied on Password Recovery page
The password recovery page is at "/user/password", not "/user/pass".

I also get an Access Denied when visiting "/user/pass" on one of my sites, whether I'm logged in or not, so I think you can assume this is the expected behaviour for that particular path.