post-password-reset counter