public function resetPassLogin(Request $request, $email, $timestamp, $hash) {
    $user = NULL;
    $email = base64_decode($email);

    try {
      $user = $this->apiWrapper->getCustomer($email);
    }
    catch (\Exception $e) {
    }

    // Verify that the user exists and is active.
    if (!$user) {
      // Blocked or invalid user, so deny access. The parameters will be in the
      // watchdog's URL for the administrator to check.
      throw new AccessDeniedHttpException();
    }

    // Wrap user in CommerceUserSession.
    $account = new CommerceUserSession($user);

    // The current user is not logged in, so check the parameters.
    $current = REQUEST_TIME;
    // Time out, in seconds, until login URL expires.
    $timeout = $this->config('user.settings')->get('password_reset_timeout');

    if ($current - $timestamp > $timeout) {
      drupal_set_message($this->t('you have tried to use a one-time password reset link that has expired. Please request a new one using the form below.'), 'error');
      return $this->redirect('acm.external_user_password');
    }
    elseif (($timestamp <= $current) && Crypt::hashEquals($hash, acm_commerce_user_pass_rehash($account, $timestamp))) {
      $password_values = $request->get('new_password');
      $pass1 = trim($password_values['pass1']);
      $pass2 = trim($password_values['pass2']);
      if (strlen($pass1) > 0 || strlen($pass2) > 0) {
        if (strcmp($pass1, $pass2)) {
          // Passwords don't match, return back to the reset password page so
          // they can correct.
          drupal_set_message($this->t('The passwords you entered do not match.'), 'error');
          return $this->redirect(
            'acm.external_user_password_reset', [
              'email' => base64_encode($email),
              'timestamp' => $timestamp,
              'hash' => $hash,
            ]
          );
        }
      }

      $updated_user = FALSE;
      try {
        // Update customer's password.
        $updated_user = $this->apiWrapper->updateCustomer($user, ['password' => $pass1]);
        // Generate and store the access token and log the user in.
        if ($token = $this->userAuth->authenticate($email, $pass1)) {
          $this->commerceUserManager->setAccessToken($token);
          // This will retrieve and store the account with the new access token.
          $this->commerceUserManager->getAccount();
        }
      }
      catch (\Exception $e) {
      }

      if ($updated_user) {
        drupal_set_message($this->t('Your password has been updated.'));
        return $this->redirect('acm_customer.view_page');
      }
      else {
        drupal_set_message($this->t('There was an issue updating your password.'), 'error');
        return $this->redirect('acm.external_user_password');
      }
    }

    drupal_set_message($this->t('You have tried to use a one-time password reset link that has either been used or is no longer valid. Please request a new one using the form below.'), 'error');
    return $this->redirect('acm.external_user_password');
  }