The link in the recovery email opens /recovery?code=...&uid=.... There you re-enter your email (it must match the account's email exactly) under Confirm Email, and choose a new password (minimum 8 characters) under Password and Password Confirmation. If the code doesn't match what was emailed to you, or the email doesn't match, the reset is rejected with "Code not match" or "Email not match." On success you're logged in automatically and sent to the homepage.