Password reset tokens can have a custom expire time.

@gogregor Please review. If everything is okay, please click "merge pull request".