Fix accept-invite webhooks

[chrisshiplet]

#544

I wasn't super clear from the original PR that introduced this regression (#515) if it was trying to fix something else that I overlooked, but it causes the set password page to POST to the reset password page which bypasses the accept-invite webhook.

[Alexander-Prime]

This causes a test failure, but the test is just:

GET /user/reset-password
...
  ✖ 48) includes code_challenge in the password recovery form action

It's basically just checking that this line exists. All the other tests pass. I'm trying to work out now why this change was made in the first place.