Improve password reset token

no issue
- added check that a combination of email + expires is rejected after
10 attempts
- changed comparison to time independent method

Thanks to @chiiph for reporting this issue!
Merge pull request #2082 from sebgie/fix-reset-token
Version bump for 0.4.1
Merge branch '0.4-maintenance' into moya-0.4

Conflicts:
	package.json