Check if it is possible to reinitialize the password twice or more

I added a test to check the issue #43. It passed, so I suppose the issue #43 has been fixed.

The `UserForgotPassword` has not an expiration time: if the token is not `null`, the token will be considered as valid.

The relation between `User` and `UserForgotPassword` has not to be changed:
* if `User` has not an `UserForgotPassword`, the system will create it.
* if `User` has a `UserForgotPassword`, the system will use it.

In all cases, a new `token` will be generated.