Don't show header twice.
Check whether the reset code has already been used.
Use something other than 'email' for the email field name, because chromium acts oddly with 'email' fields.
Show login form after resetting password.
Specify the page in the form action, because we include this page from the password reset page.