Step 1 issues a reset token (in this local build it prints in the API console). Step 2 sets the new password with it.