Request a single-use password reset link. For privacy, the response is the same whether an account exists or not.