Clear password reset tokens after use

This isn't strictly necessary (without this patch, a user will be able to reset his/her own password again with the same link within a 2-hour window), but I think we should have this here.

Sidenote: the messages displayed by ':notice => "blah"' are unreadable with the new style, since they show up as dark-colored on a dark background.