Do not use canAuthenticate() to check if user can reset lockout

canAuthenticate() is meant for apps so it will reflect the
FACE_UNLOCK_APP_ENABLED setting. If disabled, resetLockout will not be
run for that user.

Fixes: 138269776

Test: Disable unlocking for apps, get locked out, enter password.
      Lockout is reset now.

Change-Id: I5d7bf3abbac7c8982595d5733464a887ab5184ab