Password reset now invalidates old password, and sets to state 'approved'.