user delete, generate token, change password verification