Consder adjusting the return type of the Graph API requestPasswordReset.

[zorn]

For the new requestPasswordReset graph endpoint, it is documented to return a nullable User and, in fact, always returns null no matter if the email is known or not. That last part is good, though I wonder if the endpoint should :ok or something.

Should look around and see how other Graphs handle this kind of request.