Fix predictable password-reset tokens

Not solved

Reset tokens come from Math.random() and the clock, and stay valid for a week. Make them unguessable and short-lived.

reset-token.js

Test results

Run the tests to check your code. It runs on the server in an isolated sandbox with no network access.