Avoid generation of multiple tokens

Avoid generation of multiple tokens, so if the database got leaked, the attacker will not be able to reset a password with previous tokens of an user.