User login block still shows link to password reset, even if access denied