Password token is generated when the user requests a reset