I checked the logs on the server and it wasn't the password that was the issue, it was complaing that the token was not valid. From what I can see, this is because the passwrd was successfully reset and the token was then re-used to set it to potentillaSOM46#! which failed because the token will have expired when the first rest succeeded.
Did you re-use the same link, or did you do another forgot password request?Originally posted by HuwR

I think I opened the link from the mail every time, but I could have re-use the same link. Many windows opened, and maybe i choose the wrong one. I'm not sure what I did. Thanks for explaining. I understand a lot more now.

latest code iteration uploaded, it's getting there

the link:
https://snitzcore.themediawizards.co.uk
(so that I easier can find it ...)

@huwr @Torborg never seen the snitzcore site before what is the idea behind it etc.