send mail to user after resetting password
add comment about token validity