Add two more exceptions to the admin router auth middleware application

src/api/index.ts

@@ -33,7 +33,10 @@ export default (rootDirectory: string): Router | Router[] => {
   router.use("/admin", cors(adminCorsOptions), bodyParser.json());
 
   // Add authentication to all admin routes *except* auth and account invite ones
-  router.use(/\/admin\/((?!auth)(?!invites).*)/, authenticate());
+  router.use(
+    /\/admin\/((?!auth)(?!invites)(?!users\/reset-password)(?!users\/password-token).*)/,
+    authenticate()
+  );
 
   // Set up routers for store and admin endpoints
   const storeRouter = Router();