Make password reset keys single use

Locks the user row and clears the reset key on first use, so two parallel password updates with the same key cannot both succeed.