Really, that's it. The first proper zero auth password reset I've seen in production. Yikes this is a bad one.