Password reset no longer leaks enrollment info