Requirement 8.5.2

Verify user identity before performing password resets.