Do not expose user info in `/reset` responses. Fixes #249