Update tests for reset password

Ensure reset password works, and update tests to match
new API semantics around password tokens