More secure implementation of reset password: only store a hash of the reset password token

So that if attacked can somehow read DB, they won't be able to read the unhashed password reset token and be able to reset password for any account of their choosing