use token table for requesting new pwd