You should allow to reset password to the users without authentication (and therefore without authorization).

That's the nature of password reset link.