move updating total out of loop for password_reset (ala #42)
If the user is prompted to enter an existing password, we don't have a new user flow