Reset access securely.

Reset tokens expire after one hour and active sessions are revoked after a password change.