I notice now that in `confirm_reset_password.js` it's actually checking  `Session.passwordForgotToken` so this suggestion makes less sense. I say we go with this for now and if continue to have this situation we can work on enhancing `mustAuth`.