Password reset is vulnerable to injection attack

[samiy803]

We should not rely on the client's action URL since this allows an attacker to send reset tokens to their own server

TurboCore/api/src/auth/reset_password.rs

Line 89 in c01ae6d

let action_url = format!("{}?token={}", body.reset_url, reset_token);