Spec'd and implemented POST /new-password/:verificationId