Hosted password-reset page

Landing page for the link in hiyd's password-reset email. It has its own path, rather than /auth/action, because Android App Links can't filter on the query string: keeping reset links off /auth/action lets the app claim that path for verification links while reset links stay in the browser. A link whose mode is something other than resetPassword is redirected to /auth/action with its query intact.