In standard sql, join binds tighter than comma, so we were joining on the wrong table. Postgres follows the standard (apparently).

Fix password reset

Default requester to None, otherwise it isn't defined when resetting using email auth

If they registered with an email address and email notifs are enabled on the HS