Finds a reset token by its plaintext value when still valid.
Plaintext URL-safe reset token.
Reference time for expiry comparison.
The matching record when valid; otherwise null.
Finds a reset token by its plaintext value when still valid.