Reset access securely.

We send a short-lived, single-use link without revealing whether an account exists.