@jreschke https:// w3c.github.io/webappsec-change -password-url/response-code-reliability.html#the-resource-that-should-not-exist-whose-status-code-should-not-be-200-well-known-uri