mark password reseted emails as verified

if an email is not verified, and the user goes through the
reset password flow, then the email really should be verified.

fixes #2925