Reset password

Sends a one-time link to /login/set-password. No password is ever set or sent.