Can password reset also serve to verify a user's email address?