public function resetPassword($tokenString)
    {
        $this->loadModel('Wasabi/Core.Tokens');
        /** @var Token $token */
        if (!$tokenString || !($token = $this->Tokens->findByToken($tokenString)) ||
            $token->hasExpired() || $token->used
        ) {
            $this->redirect('/');
            return;
        }

        $user = $this->Users->get($token->user_id, [
            'fields' => ['id']
        ]);

        if ($this->request->is('put') && !empty($this->request->data)) {
            /** @var User $user */
            $user = $this->Users->patchEntity($user, $this->request->data, ['validate' => 'passwordOnly']);
            /** @var Connection $connection */
            $connection = $this->Users->connection();
            $connection->begin();
            if ($this->Users->save($user)) {
                $this->Tokens->invalidateExistingTokens($user->id, TokensTable::TYPE_LOST_PASSWORD);
                $connection->commit();

                $this->Flash->success(__d('wasabi_core', 'Your password has been changed successfully.'));
                $this->redirect(['action' => 'login']);
                return;
            } else {
                $connection->rollback();
                $this->Flash->error($this->formErrorMessage);
            }
        }
        $this->set('user', $user);
        $this->render(null, 'Wasabi/Core.support');
    }