change generatePasswordResetToken to test that entire user object is returned