Is this a valid approach to password reset I’m currently building a password reset flow and wanted to check this made sense.