R1:152f05aebed0

Fix some security issues with email password resets

Summary:
Via HackerOne, there are two related low-severity issues with this workflow:

- We don't check if you're already logged in, so an attacker can trick a victim (whether they're logged in or not) into clicking a reset link for an account the attacker controls (maybe via an invisible iframe) and log the user in under a different account.
- We don't check CSRF tokens either, so after fixing the first thing, an attacker can still trick a //logged…