Validates a reset token and returns its record when still usable.
URL-safe reset token from the client.
Matching token record when valid; otherwise null.
Validates a reset token and returns its record when still usable.