code: protected function checkResetLink()
      {
          // Check if the reset links are enabled, if token is present,
          // if it has a valid format and length
          if (!$this->config["enabled"]
              || !($token = $this->httpRequest->query->get("confirm", false))
              || !preg_match("/^[a-f0-9]+$/", $token)
              || strlen($token) !== 2*($this->config["tokenIdLen"]+$this->config["tokenLen"])) {
              return;
          }
  
          // Delete the active password reset session, if set
          $this->session->remove("pwreset");
          
          // Split token parts
          $tokenId = substr($token, 0, 2 * $this->config["tokenIdLen"]);
          $verifier = substr($token, 2 * $this->config["tokenIdLen"]);
  
          // Validate token timeout
          $tokenData = $this->storage->getResetToken($tokenId);
  
          // Token not found or expired
          if (!$tokenData || time() > $tokenData['valid']) {
              $this->session->addFlash("error", "Reset link has expired.");
              $this->getLogger()->warning("Bad reset token {t} from {addr}", [$token, $_SERVER['REMOTE_ADDR']]);
              $this->picoAuth->redirectToPage("password_reset");
          }
  
          if (hash_equals($tokenData['token'], hash('sha256', $verifier))) {
              $this->session->addFlash("success", "Please set a new password.");
              $this->startPasswordResetSession($tokenData['user']);
              $this->logResetLinkVisit($tokenData);
              $this->picoAuth->redirectToPage("password_reset");
          }
      }
docs: Validates a password reset link
  
  If a valid password reset link was provided, starts a password reset
  session and redirects to a password change form
  
  @return void