Improve password reset token

no issue
- added check that a combination of email + expires is rejected after
10 attempts
- changed comparison to time independent method

Thanks to @chiiph for reporting this issue!
Merge pull request #2082 from sebgie/fix-reset-token