Be More Specific about Reset Password

Only fetch the user if there's a reset key present.

Also rely on the special `null` falue to mean "we haven't yet tried to
fetch the user".

That's a big questionable, but it will work.