Renders /reset-password, for anyone: the request for a reset link, or, with the link's ?token=, the new password. It doesn't sign the user in: a success links to /login.