more secure password reset

the token is not stores in plain text in the database, but is hashed
with a salt. Just like a standard password