Reset links expire after 30 minutes, work once, and revoke existing sessions after the password changes.