Token was mistakenly being retrieved from cookie instead of the HTTP body of the POST when user calls change password