Not challenged: holding the emailed token already proves control of the
address. A missing, used or expired token shows the invalid-link state with
a way to request a new email. On success the learner goes to sign-in, which
confirms the change; the reset has signed them out everywhere else.
Sets a new password with the token from a reset email.