improve password reset systemw workflow to be a bit less weird

This may fix these lines in the log:

Login failed by 'xxx' using cookie

Since now the session can be formally invalidated,
the user_uid cookie is wiped in case, and your browser does not
try cookie authentication in the consequent request.