Should probably redirect if no user is found for password reset