Prepare a query for a password reset request.

This preparation performs three jobs, one before the query executes and two after:

1. it constraints the query to match the identity field passed to the action.
2. if there is a user returned by the query, then a. generate a reset token and b. publish a notification.

Always returns an empty result.