Fix reset token verification

closes #3872
closes #4603
- updated regex to work with url safe tokens