What I would love to understand is why does the reset password token work when the host name doesn't resolve to the right host name?