password_resets endpoint embeds the user id in the expiring code

instead of the email