fixed multiple password reset bug

We only allow a single reset password at a time (mostly as an anti-DoS measure), so we delete the old one before adding the new one.  Unfortunately, I forgot to commit the delete, so if someone requested a password reset and then forgot they did so and then made another request before the original one had expired, they'd get an error.