Reset access securely.

Recovery tokens are single-use and expire. Production delivery belongs in the email notification provider.