Use hex instead of base64 for password reset token