Proper messaging on password reset

fixes #3540
- Show proper message when reusing token
- Show message after resetting password