Fixed #27518 -- Prevented possibie password reset token leak via HTTP Referer header.

      Thanks Florian Apolloner for contributing to this patch and
Collin Anderson, Markus Holtermann, and Tim Graham for review.