Password reset links sent via email are returning a 404 error. The root cause appears to be incorrect token validation logic after the URL encoding change implemented last sprint.