Response when someone has a typo in $tmp_password

Thanks for the module, it works great. I have just experienced one little thing for the route /user/lost-password-reset?_format=json
If someone enters a temp password here which is not the same stored for the user - there is no response text from the server. I created a small patch so that the user can get feedback, that the recovery password is not valid.