set token + expiry to None after password reset