Do you ever reset your counter in case the user wants to change the password a second time?