Update convict to newer version
Fixes #94 : Make sure we replace accountResetTokens
Add tests to make sure accountResetTokens are replaced

In some cases (createAccountResetToken() and forgotPasswordVerified())
we need to make sure the accountResetToken is replaced, not just have
a new one added. These tests will help implementations for backends.