Reset access securely.

We never reveal whether an email address belongs to an account.