clear token on password change