A bit confused here. We seem to switch between friendly strings "Email address" and "New password" versus config names "accountResetToken". Semi-global comment, I guess.