Only send reset password token to client if password hasn't been previously set