How is the reset password flow supposed to work?