title: Why not using current hash password to sign the reset token?
body: <p>I have read through many guides about best practice to create a user reset password token. They're all saying that we should create another database table and store the hashing of the token. </p>
  
  <p>And it comes to my mind that why don't we just re-use the current hash password to sign the reset token? We email the user with that token, then check if they are match. </p>
  
  <p>If the user changes the password, the token would be invalid then so it makes sure one time use. So now we don't have to add extra table.</p>
  
  <p>Not sure if I miss something here?</p>