The problem boiled down to our AWS setup, which forwards requests. The URL can be configured with:

'account-email-password-resetter' () {
    tokenVerifierURL = 'https://tigase.im/rest/user/resetPassword/'
}

But I opted to use X-Forwarded-For header.