this *looks* right to me.  poses some challenges testing.  @jrgm should stage password resets on old software then verify on new software to test this properly.