AccountForm should read pass-reset-token only from query string