replaced hardcoded settings with settings.CONFIG and fixed the resend POST problem in create_token() and change_password()