generally speaking if the url starts with a plural I'd assume a resource collection which should be followed by the explicit id of a specific resource within that collection.

But this is not the case here - we don't allow reset of any selectable user.

I like
/password/reset
/password/reset/mail