Do not sign users in after they finish the "password forgotten" flow

[davout]

Otherwise a yk and ga protected account can be accessed if an attacker has access to the victim's e-mail