Your login page template (/includes/templates/ZC03C00220/templates/tpl_login_default.php) is (a) directly coding the HTML <form> for the create_account portion of the page and (b) not including the hidden input variable that includes the current session's securityToken value.
Ditto on the password_forgotten template (/includes/templates/ZC03C00220/templates/tpl_password_forgotten_default.php).
When I search on that template (ZC03C00220) in google, most of the pages found advertise that template for Zen Cart v1.3.8a. If your store's just getting started (which it looks like it is), I'd ask for my money back and find a template that works properly with Zen Cart v1.5.0 and later.