Reset password timing fix

Add timing-safe comparison for token checking.