sending reset token works
actually random token
a couple minor tweaks