Fix bug regarding token deletions upon successful password resets

[roberto-aguilar]

In the default authentication system created by the mix phx.gen.auth, when a password has been successfully reset, it deletes all of the tokens regardless of their context, however, this is problematic in the following scenario:

• A user has been registered, which creates a token with the confirm context and account confirmation instructions delivered via email.
• The user has not clicked on the confirmation email message yet.
• The user requests password reset instructions and gets them via email.
• The user successfully follows the password reset instructions.
• The user tries to click on the confirmation email, but it is no longer valid.

By scoping the deletion to only reset_password tokens, the bug is gone and the confirm token will still be valid regardless of the abovementioned process.

[josevalim]

Resetting the password should typically invalidate all other sessions, requests to change emails, etc. It doesn't need to reset the confirmation token indeed, but almost everything else is a must.

[ShPakvel]

Resetting the password should typically invalidate all other sessions, requests to change emails, etc. It doesn't need to reset the confirmation token indeed, but almost everything else is a must.

@josevalim, this sounds reasonable for me as well. I've added necessary changes to keep confirmation token on this case. There is also other case (email change) that I think should be improved from security point of view. Some corrections. And optional idea described to consider as well. Could you please review it? Thank you in advance. 🙇🏼 #5951