Don't display the password editing form if the user's token is expired;
redirect to the form that allows users to request a new password reset
token.