The test was only freezing time for the first two calls to password reset
which meant that sometimes the last call to reset password was far enough
in the future to not be affected by the rate limiting.
We move the freeze_time context manager to outside of all the password
reset calls to make things more reliable.