Don't expose whether another user's email is validated
Show reset password validation errors instead of error 500
CSRF protect password reset request form