Fixes #5088: new password reset token is now generated only if previous one was already used or expired
