pwreset: Fixup password reset system

Turns out that the new authentication system incorrectly cancels the reset tokens when it processes logins rather than after the user successfully resets his/her password