more validation for password reset token in advanced app

fixes #2099