I'm creating a different user collection for a specific user group which have fewer permissions than a regular user and shouldn't be able to interact with the admin area at all.
So I created a collection with the auth: true option, this all works fine. I even managed to create a custom login form.
After that I tried creating a "password forgot" page, but here is where I hit a snag. The password reset email send successfully and the link in the email works but when I try to reset the password I get the error token expired/invalid. Weird as I just created the token, so I checked the database (MongoDB) and there is the value "Thu Jan 01 1970 00:06:00 GMT+0000 (Coordinated Universal Time)" in the "resetPasswordExpiration" field.
Payload version: 3.4.0