>  Right now, we only check for the existence of each of token, code, and email. If any of those are missing, then we print a "Link is damaged" message. 

Not sure if "Link is damaged" is the best copy, but makes sense. We might also validate the lengths of the code and token, too.

> If the backend says the link invalid, we print a "link is expired" message, which is not necessarily true.

We don't validate the link with /password/forgot/status, we validate the token. If the token appears to be the correct length, and /password/forgot/status returns 401/110, then it's expired. It was already used or it expired.

When we go to validate the actual code with /password/forgot/verify_code, you learn if the actual code is valid, but in the meantime, the token may have expired as well. 

IMO, both of these error messages are equivalent to saying "anomalies in the space-time continuum" without including actionable instructions to fix the problem.

"Link is damaged" -> "The link you clicked in your email is missing some information. Please check your email to see if it was truncated or damaged in some way."

"Link is expired" -> "The link you clicked to reset your password is expired. Click here to receive a new reset link."