Recover access securely.

A short-lived, single-use link is sent to the account email address. The response is intentionally identical whether or not an account exists.