goal: Add password recovery
files:
- src/auth/service.ts
edit:
behavior:
- expired tokens are rejected
- valid tokens can only be
used once