[dennisgorelik]

You should allow to reset password to the users without authentication (and therefore without authorization).

That's the nature of password reset link.

[sopooneo]

Oh of course. Good point.