use the same token for password reset via mail and sms