drop password_reset_token when password changed