Sails/Waterlock password reset flow

G'day all,

Does anyone have any experience with the Waterlock flow for passsword resets? I've hit a wall which I can see a work-around for, but it seems really in-elegant, so I'm probably missing something.

When I send through an auth/reset POST with an email element, the system proceeds to shoot the email out as planned.

When I then submit the received link in a POST request, with a password element, I see a "404" response.

HOWEVER

If I submit that link as a GET request first, and then submit the POST it works.

When I look into the waterlock-local-auth source, the reset POST action is testing for the presence of a decrypted token in the request object before allowing it to proceed.

SO

Either I code my front end to send a get request (which doesn't respond properly) and then resubmit as a POST, or I go in and hack the waterlock-local-auth code to include a decode of the token (which is what I'm thinking is the most elegant solution).

Any clues?

Thanks,

Andy