Mark password reset requests as non-authenticated