The regex for extracting the token from the password reset URL was incorrect,

which resulted in an error that claimed "The password reset link was invalid,

either because it expired or has already been used."

Went all the way through the password reset flow successfully.