Account security

Set a new BGSP password.

We email a link that works once and expires in one hour. Changing the password ends every signed-in session on the account, so other devices will ask for the new one.

The link token was removed from the browser address before this screen used it. BGSP stores only its hash, never the token itself.