POST /auth/execute_reset with different password repeat is accepted

[indr]

seneca-user options

 {
   autopass: false,
   mustrepeat: true
 }

Requests

 curl -H 'Content-Type: application/json' -v http://localhost:3000/auth/create_reset \
 > -d '{"email":"u1@example.com"}'

 ...

 {"ok":true}

 curl -H 'Content-Type: application/json' -v http://localhost:3000/auth/execute_reset -d \
 > '{"token":"69b7b3e6-41d4-4ff6-ac56-8c43e14abe16","password":"AAA","repeat":"BBB"}'
 *   Trying ::1...
 * Connected to localhost (::1) port 3000 (#0)
 > POST /auth/execute_reset HTTP/1.1
 > Host: localhost:3000
 > User-Agent: curl/7.47.1
 > Accept: */*
 > Content-Type: application/json
 > Content-Length: 80
 > 
 * upload completely sent off: 80 out of 80 bytes
 < HTTP/1.1 200 OK
 < X-Powered-By: Express
 < Content-Type: application/json
 < Cache-Control: private, max-age=0, no-cache, no-store
 < Content-Length: 487
 < Date: Wed, 03 Aug 2016 00:58:18 GMT
 < Connection: keep-alive
 < 
 * Connection #0 to host localhost left intact
 {"user":{"nick":"nu1","email":"u1@example.com","name":"u1","active":true,"when":"2016-08-03T00:53:46.891Z","salt":"{b\f\u0000Y\u0001JC_~eS\\jE","pass":"32b491b08adc6d89996ba34f4709fa57af9631b5071e95cd75a8aaf44c8bd8bab7460eb9c0bfc8184cc229738ffc989c1d3abb9743bee5baf393d994a9ed5a05","id":"bfr80g"},"reset":{"token":"69b7b3e6-41d4-4ff6-ac56-8c43e14abe16","nick":"nu1","user":"bfr80g","when":"2016-08-03T00:56:50.189Z","active":false,"id":"69b7b3e6-41d4-4ff6-ac56-8c43e14abe16"},"ok":true}