Fixed password reset: now consumes password reset token