user can generate a password token
test for finding user to reset password passing