Fixed missing password.token string and checked for user existing before attempting to send reset email