delete password token upon reset