@ckarlof - I'm digging through https://github.com/mozilla/fxa-auth-server/blob/master/docs/api.md, but I am having a hard time grokking the difference between the code and the token. To an outsider, both are strings of jibberish. Are there docs on the difference?

It sounds like what you are saying is:
* Before we render the screen, we can check whether any of the expected parameters are malformed by checking length and the types of characters.
* Before we render the screen, we can check also whether the token is valid, but not the code. A token that validates in length/characters that is not actually valid will return the same error message as a token that was once valid but the user completed the reset flow. If the token is validates in length/chars but is found to be invalid, is the action to resend the link?
* Is there any possibility of validating both the code and the token with the auth-server at the same time?
* After the user types the new password, we notify the server and send along the new password, the code, and the token. At this point, the token could have expired, or the code could be invalid. Do they return the same error? If so, is the user action the same - resend a link?

The post-send error case still needs to be handled. An error message needs to be surfaced to the user that contains a link to resend the email. Two approaches:
* re-render the entire form and display the "your link has expired" text with a link to resend the email.
* Use the small red error message area, display the error text and the link to resend the email. This would look similar to the /signin page when trying to sign in with an unregistered account.

If the user clicks the link, we will need to send them to the `/confirm_reset_password` screen.