I added middleware that takes an access token in the query string and applies
it as an Authorization: Bearer header.
A minimum password length is not enforced, causing us to subclass:
SignupFormChangePasswordFormPasswordResetTokenForm
There's an open pull
request from
November, 2014 (but it only changes SignupForm).