another case where this theoretically could be an extra round trip - but again, considering it's a password reset, we should hit cache.