mark token used after password reset
fix locale nil bug