RR: reset user password with token and hid