Learn more about cloning repositories
You have read-only access
Removed user _id from reset route. Use only token value. It's random enough that you don't need to include user id as well.