password reset link gives 'don't have permission'

I did a fresh install of Grav and set up email, then logged out and pressed the 'Forgot password' button. Grav duly sent me an email with a reset link, but the link gives 'You don't have permission to access'.

I don't know whether that's a bug or something I've done wrong.

Start by reproducing the issue from a fresh Grav install: configure email, use the “Forgot password” button, and open the emailed reset link. Trace the password-reset flow to determine why the link returns “You don't have permission to access”; done means the reset link works or the failure is clearly documented with its cause.

Written by the indexing model from the issue text.