Demo returns a reset token when SMTP is not configured. Production must email a time-limited link only.