the password reset token checking reports a status
the password reset token checking reports a status (bad, expired, reused, good)
password reset works via creating and closing a session in a single request