updated generatePasswordResetToken to return entire user object