docs: def forgotten_pw(new_user=False):
      """Reset password for users who have already activated their accounts."""
      email = request.form.get("email", "").lower()
  
      action = request.form.get("action")
      if action == "cancel":
          return redirect(url_for("login.login_form"))
  
      if not email:
          flash(_("You must provide your email address."), "error")
          return render_template("login/forgotten_password.html")
  
      try:
          user = User.query.filter(
              sql.func.lower(User.email) == email, User.can_login == True
          ).one()
      except NoResultFound:
          flash(
              _("Sorry, we couldn't find an account for " "email '{email}'.").format(
                  email=email
              ),
              "error",
          )
          return render_template("login/forgotten_password.html"), 401
  
      if user.can_login and not user.password:
          user.set_password(random_password())
          db.session.commit()
  
      send_reset_password_instructions(user)
      flash(
          _("Password reset instructions have been sent to your email address."), "info"
      )
  
      return redirect(url_for("login.login_form"))