When you say you are closing your browser, are you actually completely closing the browser, or just the browser tab that has the flexi auth demo open?
I know that at least with Chrome, if you just close the tab, then it does not remove the cookie until the browser is properly closed.
If this is not the case, could you let me know the browser version that you're using.
My first steps to diagnose the problem here would be to ensure that the user id and the uacc_forgotten_password_token both match the value within the database, then ensure that the uacc_forgotten_password_expire date is still in the future.
You can redefine the expire time of forgotten passwords via the config setting: