Don't be as restrictive in token lengths for reset tokens

Don't be as restrictive in token lengths for reset tokens

Django 3.2 changed the length of the token. And the original URLs from
the django files aren't more restrictive, so there should be no need for
us to be -- so allow a more flexible token length, making it work on
both old and new django.