.requestMatchers("/api/v1/students/set-password.html", "/set-password").permitAll()

It looks like you're incorrectly specifying the path to the restapi and html.Try changing it to

.requestMatchers("/api/v1/students/set-password", "/set-password.html").permitAll()