code: public final boolean resetPassword(String token, String newpass) {
  		if (StringUtils.isBlank(newpass) || StringUtils.isBlank(token) || newpass.length() < Config.MIN_PASS_LENGTH) {
  			return false;
  		}
  		Sysprop s = CoreUtils.getInstance().getDao().read(getAppid(), identifier);
  		if (isValidToken(s, Config._RESET_TOKEN, token)) {
  			s.removeProperty(Config._RESET_TOKEN);
  			String hashed = Utils.bcrypt(newpass);
  			s.addProperty(Config._PASSWORD, hashed);
  			setPassword(hashed);
  			CoreUtils.getInstance().getDao().update(getAppid(), s);
  			return true;
  		}
  		return false;
  	}
docs: Changes the user password permanently.
  @param token the reset token. see {@link #generatePasswordResetToken()}
  @param newpass the new password
  @return true if successful