Extra Mitigation Curation

Arbitrary password resets via NULL reset codes There's a flaw in the DB schema where `reset_password_code` is NULL by default. If an attacker is able to provide a NULL reset code to the package, there are no guards against arbitrary anonymous password resets. In many cases, submitting a url-encoded null byte value (`%00`) will match what's in the database, passing the check and allowing the attacker to set the password to what they wish.