I use reset password. Get email. Click link. Reset password. Login on returned login form and get the error Sorry, that key does not appear to be valid. The reset password form is returned. The user is logged in but doesn't know that they think they have an error.