Password reset token delivery is deferred. Use signed recovery tokens before enabling this in production.