Reset password protocol, keeping track