Reset access without exposing accounts.

We send a short-lived, single-use reset link if the account exists. Old sessions are revoked after a successful reset.