At least 8 characters, with a letter and a number.
Reset links are single-use and expire in 30 minutes.