refactored password_reset to use token as :id in routes by overwriting to_param