Fix regex for password reset URL bracket stripping. See #364