'page hit once a user has been sent a password reset email
to verify their identity before allowing them to update their
password.'

@validate(token=VOneTimeToken(PasswordResetToken, 'key'), key=nop('key'))
def GET_resetpassword(self, token, key):

    done = False
    if ((not key) and request.referer):
        referer_path = request.referer.split(g.domain)[(-1)]
        done = referer_path.startswith(request.fullpath)
    elif (not token):
        return self.redirect('/password?expired=true')
    token_user = Account._by_fullname(token.user_id, data=True)
    return BoringPage(_('reset    password'), content=ResetPassword(key=key, done=done, username=token_user.name)).render()
