Password reset tokens only good for single use