Secure access scaffold

Reset access securely.

Password reset requests use generic responses and expiring single-use tokens.