Outside of the scope of this PR, but `confirm.js` and `confirm_reset_password.js` are so similar they should be collapsed to keep ourselves DRY.