Security
Request a reset and apply the reset token. Confirming a reset revokes existing sessions.
Enter an email or username. Production email delivery comes later.
This is mostly for local/dev until email templates are wired.