login/pass: set user cookie after token reset