Turns out that the new authentication system incorrectly cancels the reset
tokens when it processes logins rather than after the user successfully
resets his/her password