RR: allow anon-user with token to rest password