title: Flask-Security reset password functionality exploited
body: <p>I have a flask application running on a production environment, and one of the user requested a password reset, which sent out an email to them with a link back to the site for resetting the password.</p>
  
  <p>That email got shared with a third-party probably, and the link got exposed. Now the reset request is being spammed from multiple IP addresses. There is a timer I set using the <strong>SECURITY_RESET_PASSWORD_WITHIN</strong> config parameter to 30 mins and I can see that it does work as intended, the link is invalidated and throws an error saying the link has expired.</p>
  
  <p>But the default behavior of the Flask-Security package is to re-send the reset email to the user if the token has expired when doing a GET request to the reset page with the expired token. So someone can keep spamming that expired link using 
  <strong>GET /reset/token_id</strong> 
  and the user keeps getting sent reset emails.</p>
  
  <p>What is the correct way to handle this situation?</p>