removed expired file from wrong directory
added hidden field for user token
finished password reset & token authorization tests