add pwd_reset_token to User model