Request a one-time token, then choose a new password.
At least 10 characters with upper/lowercase and a number.