Found a nasty bug. Fixed it.

lib/Lystyng.pm

@@ -387,35 +387,23 @@ post '/passreset' => sub {
   my $code = body_parameters->{'code'};
 
   unless ($code) {
-    return {
-      status => 400,
-      message => 'Reset code missing',
-    }
+    send_error 'Reset code missing', 400;
   }
 
   my $ps = $model->get_passreset_from_code($code);
   unless ($ps) {
-    return {
-      status => 400,
-      message => "Code $code is no longer valid",
-    };
+    send_error "Code $code is no longer valid", 400;
   }
 
   my ($pass1, $pass2) = (
     body_parameters->get('password'), body_parameters->get('password2')
   );
 
   unless ($pass1 and $pass2) {
-    return {
-      status => 400,
-      message => 'Must fill in both password fields',
-    }
+    send_error 'Must fill in both password fields', 400;
   }
   unless ($pass1 eq $pass2) {
-    return {
-      status => 400,
-      message => 'Password values are not the same',
-    };
+    send_error 'Password values are not the same', 400;
   }
 
   $model->update_user_password(

t/003_user_admin.t

@@ -99,14 +99,14 @@ $res = $test->request(POST '/passreset',
   Content_type => 'application/json',
   Content => encode_json({ 
     code      => $code,
-    password1 => 'Newpass',
+    password  => 'Newpass',
     password2 => 'Newpass',
   }),
 );
 
 ok $res, 'Got a response from /passreset';
-is $res->code, 200, 'Response is 200'
-  or diag $res->content;
+is $res->code, 200, 'Response is 200';
+diag $res->content;
 
 # Clean up after ourselves
 $user->password_resets->delete;