Resetting a tenant's admin password now requires signing in as the platform Superadmin first, so an anonymous visitor can no longer take over a business just by knowing its Business Code.