use correct password reset token. fixes #15