add token hidden field to password resets show page