Exposing reset password token as a nodejs api