add option to scrub reset_password_token from query params