Reset token is created with email, not from username