Must I use /auth/password/request ?

[glowkeeper]

Is pinging /auth/password/request the only way a user can reset their password? The whole 'email a user' workflow is problematic for me, as HIGH COMMAND have requested authentication via mobile phone numbers...eek!

Anyway, for now, I can put them off...

Meanwhile, if I'm tied to /auth/password/request, what form does PASSWORD_RESET_URL_ALLOW_LIST take? Is it a comma-separated string, i.e. "PASSWORD_RESET_URL_ALLOW_LIST="http://my.fab.production.webserver/user/password/reset, http://my.local.devserver/user/password/reset", or some other form, and relative to directus (I hope not)?

[glowkeeper]

Opps - meant to post this in #latest :(