Cannot log in via link in welcome / password reset e-mails

I second this.
We had /user/reset/* in the list of paths (reversing the condition), but after updating from 3.0.2 => 3.0.4, the config was changed and that path was removed somehow, while retaining other paths.
Having this in the list of protected routes would have prevented that altogether.

Makes sense and I agree both routes should be ignored by default.

Automatically closed - issue fixed for 2 weeks with no activity.