Fix the password reset URL.

The regex for extracting the token from the password reset URL was incorrect,
which resulted in an error that claimed "The password reset link was invalid,
either because it expired or has already been used."

Testing done: Went all the way through the password reset flow successfully.

Fixes bug 3395.

Reviewed at https://reviews.reviewboard.org/r/5961/