Changed to not log user in while reseting password.
Old version of password reset logged user in to save username. This seemed
like it might be a security flaw, so I changed it to save it in the session
without logging them in.