modify password reset process to send the user a reset token rather than just resetting the password for them