Checks that a password-reset code is still valid and unexpired, and returns
the email address it belongs to so the client can show the member which
account they are resetting.

This is the /api/v1 counterpart of the legacy
GET /accounts/password-reset-requests/verify route; both share the same
implementation, so behavior is identical.