when resetting password also remove token from url