@ Password-reset URLs have a short lifespan.
    @ </span></p>
    style_finish_page();
    sleep(1);  /* Introduce a small delay on an invalid suffix as an 
               ** extra defense against search attacks */
    return;
  }
  fossil_redirect_to_https_if_needed(1);
  login_set_uid(uid, 0);
  if( g.perm.Setup || g.perm.Admin || !g.perm.Password || g.zLogin==0 ){
    @ <p><span class="loginError">
    @ Cannot change the password for user <b>%h(g.zLogin)</b>.
    @ </span></p>
    style_finish_page();
    return;