tokens expire, and a new token is generated on each forgot password request