Recover access.Do not expose event data.

Reset links should be short lived, single use, and scoped to organizer accounts. Support users never need guest selfies or private media URLs to help with access issues.