Password Reset -> Redirect

[rwieruch]

Quick question: In the guides, we are creating a session, setting the session cookie, and redirect to a (I guess) protected page. Wouldn't it add another security layer if we would do none of the above and just redirect the user to the login page? This way, even though it would have been somehow possible for someone to maliciously guess a verification token, the malicious actor would not know the associated account.