This is fine workflow, but keep in mind > and do a "we sent you a reset email" for anyone that's trying to log in but has no <stronghash> password hash. Yaho

This is fine workflow, but keep in mind > and do a "we sent you a reset email" for anyone that's trying to log in but has no <stronghash> password hash. Yahoo is an email provider so many of these users won't have an external provider to refer to.