user can reset their password
check that user has a token and that it has not expired