hash for reset password is now unique