Reset access without exposing whether an email is registered.

A time-limited link is sent only when the address belongs to an active account.