Reset password should just return false, not throw an error on a 404.