Unrelated to this change, but we should probably include `{ 'services.password.reset.token': token }` in the selector here. (To be super paranoid about password reset tokens being one-time use.)