Turns out that the new authentication system incorrectly cancels the reset
tokens when it processes logins rather than after the user successfully
resets his/her password

Also allow an administrator to lift the force password change flag without
specifying a new password.

Uses a seven step procedure:
  1. (user) Fails to login twice or more
  2. Clicks the 'Forgot my password' link on the login form
  3. Submits the username or email address and triggers a password-reset
     email
  4. Clicks the link in the email and is directed back to the reset page
  5. Enters the username or email again and is logged in
  6. Password change is forced, but current password is not required
  7. Password is updated, user can continue the session without
     authenticating again