don't assume a user was found in password reset flows