Pass the reset info in a URL fragment path

Use a link for password reset that's compatible with our dashboard URLs.

/cc @hampelm