make password reset token timeout configurable #416