That's right. When an accountResetToken is generated to satisfy a forgot-password flow, it is only protected by the TLS transport encryption.

We do need to make it clear how the token is *encoded*: probably as hex.