Make sure `$token` isn't empty. The empty string is the default `$token` value when a user is created and after a previous token is used. A malicious user can reset the password of this user using an empty token. This is a security issue.