use token from the form to submit password update