use original token to find record to reset password