Yes, the reset password flow is still unclear. I'll file a bug for this and add the # as a comment.