API: fix duplicate :get_password_token route