wait, no, it works fine when logged in, but apparently that happens whenever you retry via back button / wait too long after loading the request page - x is always the stub URL, but the "unknown or expired link" message comes only when you don't refresh (have I mentioned HN has exceptionally awful statefulness)
requesting for an unknown user gives an "unknown user" message (#125)
requesting a new password reset either expires the old one, or it just fell out randomly because of HN's godawful stateful session eviction
9000+ password with a 1-char difference at the end is rejected correctly
Stray observations: