/user/reset-password/{token}/ now returns 503 in maintenance-read-only mode