This includes:
- show an error message if the recovery link is expired, with a button
to resend the email
- show an error message if the recovery link has already been used
- include an invisible username field in the form, so that password
managers can save the new password